Cloaking methods

Every site has a cloak_method setting. Change it from Dashboard → Sites → your site → Settings.

Comparison at a glance

First-byte secrecy vs integration mode

First-byte secrecy means the browser never receives the safe-page HTML before ShieldGate's verdict runs. Not every integration mode can deliver it — themethod (redirect, cookie overlay, ...) and the integration (JS tag, WP plugin, CNAME, PHP include) interact.

When the raw JS <script> tag is pasted inside your safe page, the browser has already received the full safe HTML by the time cloak.jsexecutes. Anti-flash CSS can hide pixels, but the safe-page bytes are already visible in HAR, View Source, disk cache, and any HTML scanner. That's a post-paint gate, not first-byte secrecy — and it applies to cookie overlay, mouse engagement, and meta refresh on the raw-JS-on-safe-page integration.

Rule of thumb: if the campaign URL points at a hostname whose origin isyour own server serving safe HTML, only server-side integrations (CNAME, WP, PHP) can give first-byte secrecy. If the campaign URL points at ShieldGate directly (/r/, /m/, /g/), first-byte secrecy is automatic.

Redirect

Classic HTTP 302 to the verdict URL. Fastest and most compatible. The visitor's address bar changes to your money page URL.

Meta refresh

Returns a minimal HTML page with <meta http-equiv="refresh" content="0;url=...">. Useful when the caller strips Location headers or blocks 3xx codes.

Loading spinner

Shows a branded loading page for cloak_delay_ms before redirecting. Buys time for background fingerprint collection, and hides direct network patterns from crude scrapers.

Iframe

Renders the money page inside a full-viewport iframe. The address bar keeps showing your site's URL. Best when you're driving traffic to a domain your customers already trust.

How it works

The JS snippet or PHP/Worker integration calls the ShieldGate API, gets the verdict, and embeds the money page in an <iframe>. The money URL never appears in page source — it's loaded inside the frame at runtime.

Caveats

• The money page must allow being framed (no X-Frame-Options: DENY).
• Some payment providers refuse to render inside frames.
• Address bar shows your domain, not the money page domain.

Shadow (iframe-based)

Server-side iframe delivery via /m/<siteKey>. The server generates an HTML page with a full-viewport <iframe> pointing to the money page. Same concept as iframe, but delivered from a dedicated URL instead of the JS snippet.

When to use shadow vs iframe

https://your-shieldgate-host/m/YOUR_SITE_KEY

Cookie overlay (cookie_overlay)

Renders a consent-style modal ("We use cookies — Accept / Decline") before revealing the money page. Real users click Accept and are forwarded; headless bots that don't dispatch the click never see the URL, since the destination is only injected into the DOM after the interaction. Selectable in the Flow wizard as the delivery method and rendered client-side by the ShieldGate SDK (/api/public/cloak.js).

Mouse engagement (mouse_engagement)

Holds a blank/loading shell until the visitor moves the mouse, scrolls, or touches the screen — then reveals the money page. Filters out headless drivers that never generate pointer events. Selectable in the Flow wizard as the delivery method and rendered client-side by the ShieldGate SDK.

Composition (Gate × Delivery)

Any of the 8 delivery methods above can run standalone, or be composed behind a Stage-1 prepage captcha. That is 8 standalone + (3 gates × 8 methods) = 32 valid runtime pairs. The gate always runs first; on success ShieldGate hands off to the configured delivery method with a short-lived signed token.

https://your-shieldgate-host/g/YOUR_SITE_KEY   # prepage captcha (Stage 1)

Prepage captcha (Business tier)

A prepage captcha runs a human check before the offer page is delivered. It's a stronger version of the engagement gate: instead of just detecting mouse movement, it challenges the visitor with a real bot-verification widget. Configure it in Flow → Status → Prepage captcha.

Single prepage vs multi-flow

• Single prepage — captcha overlays the current page. On pass, the offer is applied directly using the flow's normal cloak_method (redirect, meta, iframe, etc.).
• Multi-flow — when cloak_method is reverse or iframe, the visitor is routed to /r/<siteKey> or /m/<siteKey> after the captcha passes, so the money URL stays hidden from the address bar.

Available captcha types

• Cloudflare Turnstile — privacy-friendly, no puzzles. Requires a Turnstile site key on the flow and TURNSTILE_SECRET_KEY in platform settings.
• Google reCAPTCHA v3 — invisible scoring (visitors pass at score ≥ 0.5). Requires a reCAPTCHA site key on the flow and RECAPTCHA_SECRET_KEY in platform settings.
• Custom math challenge — a small "what is X + Y?" overlay served entirely by ShieldGate. No third-party account or keys needed.

Failed captchas are shown a blank white page — the offer URL is never revealed. Prepage captcha, the WordPress plugin and packaged web-server installers (Nginx, Caddy, Traefik, Apache, OpenLiteSpeed, Cloudflare Worker) are available on the Business plan. If a site is downgraded, ShieldGate silently falls back to redirect at runtime for any method the new plan no longer entitles — the site keeps working, just without the premium delivery.

Choosing a method

• Ad platforms scanning your URL? Use reverse or shadow.
• Need max speed? Use redirect.
• Bots slipping through? Add an engagement gate.
• Payment page won't frame? Use redirect or reverse.